Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Githubassets.com Cert Has Expired

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Githubassets.com Cert Has Expired

#41

Post by gerdesj »

mschuster91 wrote: post #30
unilynx wrote: post #25

if you're using nagios, setup something like command_name check_certificate command_line $USER1$/check_http -H $ARG1$ -p $ARG2$ -4 -S -C 21 -t 20 --sni this won't warn about certificate name mismatches though

That warns only after the fact, not in advance... depending on how the infrastructure (and especially the cert procuring process, for those not using LE for whatever reason) is set up, too late.

"command_line $USER1$/check_http -H $ARG1$ -p $ARG2$ -4 -S -C 21 -t 20 --sni"

-C 21 means: Check the certificate. Warn if less than 21 days and critical when expired.

Re: Githubassets.com Cert Has Expired

#42

Post by WrtCdEvrydy »

mg wrote: post #29
unilynx wrote: post #24

Earlier quoted context omitted.

Is the '25' in 60 60 25 intentional to give a bit more margin or should it just have been 24?

Ha, I guess I made a typo when I wrote the script 6 months ago. At least I cannot remember that I had some clever idea back then, why a day should have 25 hours. Fixed now. Thanks.

Always have days having 25 hours... for DST.

Re: Githubassets.com Cert Has Expired

#43

Post by brianhicks »

mg wrote: post #18

This is a script I call "certdays.sh" which you can call from your regular tests like this: certdays.sh somedomain.com 14 If the certificate for somedomain.com is valid less then 14 days, it will fail: https://github.com/no-gravity/certdays

What shell are you running this under? Unquoted exclamation marks will do things that may be outside your intent for this script. It’ll still fail, just perhaps not in the way you expect.

Re: Githubassets.com Cert Has Expired

#44

Post by brian_herman »

mg wrote: post #18

This is a script I call "certdays.sh" which you can call from your regular tests like this: certdays.sh somedomain.com 14 If the certificate for somedomain.com is valid less then 14 days, it will fail: https://github.com/no-gravity/certdays

Thanks awesome script!

Re: Githubassets.com Cert Has Expired

#45

Post by KingOfCoders »

diggan wrote: post #39
KingOfCoders wrote: post #33

Earlier quoted context omitted.

Verify that it is working after changes, with a test? What is testing that test?

If you change something, don't you manually check that it's actually doing what you want it to? If I was an engineer changing a test regarding SSL certs expiry time, after a change, I'd test it with a cert that has expired, about to expire and one far in the future. Manually or automated doesn't really matter, but test your changes after you've done them. Really basic stuff.

My point was, there is no way to guarantee bugfreeness in any way. You can reduce bugs by automating and another test layer, but each new layer can have bugs too. Even if you prove the code to be correct, you only proved your assumptions of the requirements which might be wrong (both your assumptions and the requirements).

Because the comment said something like: There was a bug, so they didn't have a test, why don't they? And I replied: Tests can have bugs too.

Re: Githubassets.com Cert Has Expired

#47

Post by chillaranand »

mg wrote: post #18

This is a script I call "certdays.sh" which you can call from your regular tests like this: certdays.sh somedomain.com 14 If the certificate for somedomain.com is valid less then 14 days, it will fail: https://github.com/no-gravity/certdays

We can also use ssl-cert-check cli tool. `ssl-cert-check -s avilpage.com -p 443 -x 30` will return if the certificate will expire in 30 days.

We can use this command in CI pipeline or setup a cron job to monitor it.

Re: Githubassets.com Cert Has Expired

#49

Post by pupdogg »

Once identified, I would expect their "Incident Report" in some way would mention the root cause of the incident. However, that does not seem to be the case here: https://www.githubstatus.com/incidents/4mzhxxpwgvqg

Maybe someone could get fired for this or does it have more to do with Microsoft's stock/public image?

Re: Githubassets.com Cert Has Expired

#50

Post by mg »

brianhicks wrote: post #43
mg wrote: post #18

This is a script I call "certdays.sh" which you can call from your regular tests like this: certdays.sh somedomain.com 14 If the certificate for somedomain.com is valid less then 14 days, it will fail: https://github.com/no-gravity/certdays

What shell are you running this under? Unquoted exclamation marks will do things that may be outside your intent for this script. It’ll still fail, just perhaps not in the way you expect.

You mean due to history substitution? If so: I have never seen that kick in in a script. Only in interactive shells.
Post reply on HN